A GitLab user allowed to configure an agent workflow should not thereby gain the operating-system authority of the service processing it. CVE-2026-90970 breaks that separation: a crafted Duo flow configuration can escape a prompt-template sandbox and execute arbitrary commands on an affected AI Gateway.
GitLab disclosed the flaw October 2, 2026 and rated it critical at CVSS 3.1 9.9. Exploitation requires authentication and Duo Agent Platform access. It is not a reported anonymous, zero-click takeover of every GitLab server. The seriousness lies in the boundary crossed after those prerequisites, not in pretending they do not exist.
GitLab-hosted gateways have already been patched. Operators of affected self-hosted gateways own the upgrade and investigation of their deployment. Keeping code and prompts inside a private network does not automatically keep an authenticated configuration author inside the intended sandbox.
Verify the gateway's version, not only GitLab's
The disclosed affected ranges start at AI Gateway 18.1.6 and run below 19.2.4, include the 19.3 branch before 19.3.2 and the 19.4 branch before 19.4.1. The corresponding fixed releases are 19.2.4, 19.3.2 and 19.4.1; operators should use the appropriate fixed or later supported gateway release.
These numbers describe the gateway, a standalone application service between GitLab's AI-native features and model backends. It handles application logic and model requests; it is not the language model itself. Its image and deployment lifecycle can differ from the main GitLab application, so a familiar application-version check can miss an old gateway.
Managed, hybrid and fully self-hosted arrangements also differ. In a hybrid environment, some features may route through customer infrastructure and others through GitLab-managed services. Inventory needs feature-level routing, every gateway replica, development and proof-of-concept systems, cached images and disaster-recovery deployments—not merely the main production interface.
A fully self-hosted configuration can operate with little or no general internet access. That narrows some external routes but does not remove access by an authorized insider, stolen account, service token or another compromised internal workload. Disconnection can also slow security notifications and patch delivery.
The failure happens in template software
An agentic flow can combine prompts, tools, decisions and actions into a multistep development task. Templates turn configuration and runtime values into model instructions. Their sandbox is supposed to stop template input from reaching unsafe application functions or operating-system capabilities.
The flaw is classified as CWE-1336, improper neutralization of special elements used in a template engine. Attacker-controlled syntax can be interpreted as executable template behavior instead of inert data. For this issue, GitLab describes arbitrary command execution on the AI Gateway; what follows depends on process permissions, exposed objects, available credentials and network paths.
That is distinct from prompt injection. Prompt injection attempts to redirect a model through instructions; template injection attacks the conventional software constructing or rendering those instructions. Command execution can occur regardless of the model's reply. Adding a behavioral safety instruction to the model is therefore not the remedy for unsafe template processing.
It is also not evidence that a model independently invented an escape. The input surface is an AI workflow, but the vulnerable boundary belongs to application software. Security review must extend to configuration histories, gateway and container activity, permissions and downstream credentials, rather than treating conversation transcripts as the entire incident record.
Why an authenticated flaw is rated 9.9
The published vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Network exploitation does not require an existing local shell, but “network” does not necessarily mean a public internet endpoint. Low complexity indicates no narrow race or unusual state is required in the standardized assessment; low privileges still mean a user must authenticate and have platform access.
No further user interaction means someone else need not open a file, approve a dialog or click a lure after the malicious configuration reaches the path. Changed scope captures the move from authorized workflow input into another security authority: the gateway's command environment.
High confidentiality, integrity and availability impact reflects possible access to readable information, modification and disruption. The 9.9 standardized assessment is not proof that each deployment suffered maximum damage or any breach. Architecture, least privilege, reachable systems and secrets determine the actual blast radius.
An authenticated user is not automatically trusted to administer infrastructure. Flow authors may need substantial application functionality without being entitled to the interpreter process's operating-system permissions. A compromised token or overprivileged automation identity can make that distinction relevant even when the original user was legitimate.
Containers are another boundary, not an eraser of risk. Even a non-root container can expose mounted secrets, service tokens, handled data and internal network routes. Writable mounts, excessive privileges and broad egress can enlarge consequences; command execution on one container does not automatically prove total infrastructure compromise.
A second critical finding raises an architectural question
In February, GitLab addressed CVE-2026-1868 in the gateway's Duo Workflow Service. It also involved insecure expansion of user-supplied templates through crafted platform flows and carried the same 9.9 score and vector. Fixed releases included 18.6.2, 18.7.1 and 18.8.1, and GitLab credited an internal team member.
The similarity warrants deeper review of the flow-to-template trust boundary. It does not prove that October's issue is a regression, an incomplete February fix or the identical unsafe path. Public summaries do not establish that relationship, and none of those explanations should be presented as confirmed.
Flexible declarative configurations can act like programming languages when a service converts their expressions, variables and plugins into privileged actions. More customization increases what parsers and sandboxes must interpret safely. The risky combination is untrusted template rendering and valuable infrastructure access in one process.
Independent layers remain useful: treat input as data, expose minimal template objects, authorize flow submission, constrain filesystem/network/credential permissions and preserve attributable changes. Flow creation or modification should be traceable to subsequent gateway behavior. Custom flows deserve ownership, review, versioning and testing comparable to CI configuration.
Patching and determining compromise are different jobs
Operators should preserve the prior image digest and deployment evidence, install a fixed version, restart workloads and verify the actual running image. Old replicas, test clusters and recovery environments must not retain an affected image. A successful startup alone is not evidence that every copy was replaced.
The vulnerable-period review should identify which human and service identities could create or modify Duo flows, retain their configurations and inspect available audit records. Unexpected child processes, command interpreters, file changes, outbound connections or unusual restarts warrant investigation against normal behavior. These are review leads, not a published universal set of indicators for this CVE.
Installation documentation describes signed JSON Web Tokens and separate AI Gateway/Agent Platform services with separate signing-key pairs. Investigators should assess both services, their trust relationship and runtime keys/configuration, not assume one credential represents the whole system. Credentials accessible to a compromised process may need rotation when evidence or exposure warrants it.
Map the GitLab instance, model servers, monitoring and internal systems the gateway can reach. Source-derived prompts and issue context may be sensitive even if little data is stored in the container. Narrow egress, workload identities, read-only filesystems and minimal privileges can contain impact, but do not repair the template flaw or replace the upgrade.
Self-hosting distributes work among platform, model, container and network teams. An unassigned gateway image can fall between those owners. Managed service reduces this particular customer patch task while bringing different vendor, residency and dependency choices; the incident does not prove one arrangement is always safer.
What the public record does not show
The available accounts do not establish active or widespread production exploitation, a public proof of concept, a detailed call path or universal post-compromise indicators. No public confirmation is not confirmation that nothing happened. Vendor-confirmed command execution and the critical rating justify remediation without waiting to turn uncertainty into additional exposure.
Next evidence should include verified customer patch adoption, a fuller GitLab explanation of the root cause and credible exploitation telemetry or revised agency guidance. Root-cause detail could distinguish a separate path from a bypass or regression after customers have time to update. Local completion records should identify old/new images, restart time, validation and accountable owners, with preserved incident and configuration history.
The useful operational test is whether an organization can answer which gateways exist, who could alter flows and which assets and secrets each process could reach. AI middleware belongs beside CI runners, artifact repositories and secret managers in production discipline. Data locality becomes meaningful control only when the organization can inventory, patch, isolate and investigate the service that exercises it.
Sources and related reading
CVE-2026-90970 record · AI Gateway documentation · Template-engine weakness CWE-1336 · Duo self-hosting architecture · Gateway installation and signing keys · Earlier CVE-2026-1868 record · Engineering incident-record guidance · Original discovery record